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DETAILED ACTION 

Applicant's election without traverse of Group I, claims 1-9, 11-12, 14-17 and 26-29 of in 
the reply filed on May 19, 2008 is acknowledged. Claims 1-9, 11-12 and 14-29 are pending. 

Response to Arguments 

Applicant's arguments with respect to claims 1-9, 11-12, 14-17 and 26-29 have been 
considered but are moot in view of the new ground (s) of rejection. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claim 1-9, 11-12, 14-17 and 26-29 are rejected under 35 U.S.C. 103(a) as being 

unpatentable over Jancula US 2002/0023208 A1 in view of Sinha et al. US 2003/01 15341 A1 

(hereinafter Sinha). 

As per claim 1, Jancula teaches a computer-implemented method for enhancing the 
security of communication over a network, the method comprising: 

receiving a set of authentication credentials from a user [paragraphs 0056-0057 and 
0069-0071]; 
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receiving from the user a request that requires communication over the network with a 
remote system [paragraphs 0056-0057 and 0070-0073]; 

applying a collection of security privileges to the set of authentication credentials to 
determine if the user is authorized to carry out the request [paragraphs 0057-0058 and 0071- 
0075]; 

selectively transmitting a security certificate over the network to the remote system, the 
certificate containing a public key [paragraphs 0056-0057]; 

receiving from the remote system a session ticket that has been encrypted with the 
public key [paragraph 0088]; 

decrypting the session ticket with a corresponding private key [paragraph 0089-0091]; 

using the session ticket as an authenticator for subsequent communications with the 
remote system [paragraphs 0093-0096]. Jancula is silent on applying collection of privileges 
based at least in part upon a role-based determination that involves referencing a record that 
assigns access privileges to various roles that can be assumed by the user. Sinha teaches 
applying collection of privileges based at least in part upon a role-based determination that 
involves referencing a record that assigns access privileges to various roles that can be 
assumed by the user [paragraphs 0039-0041 and 0043-0044]. It would have been obvious to 
one having ordinary skill in the art at the time of applicant's invention to employ the teachings of 
Sinha within the system of Jancula in order to enhance the security of the system. 

As per claim 12, Jancula teaches a computer-implemented method for enhancing the 
security of communication over a network, the method comprising: 

generating a public key and a corresponding private key [paragraph 0056]; 
storing the private key [paragraph 0056]; 
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transmitting the public key over the network to a registration service [paragraphs 0056- 

0057]; 

receiving from the registration service a security certificate that includes the public key 
[paragraphs 0056-0057]; 

transmitting the security certificate over the network to an entity with which a channel of 
communication is desired [paragraphs 0056-0057]; 

receiving from the entity a session ticket encrypted with the public key [paragraphs 0060 
and 0088]; 

decrypting the session ticket with the private key [paragraphs 0061 and 0089-0091]; 

and 

using the session ticket as an authenticator for subsequent communications with the 
entity [paragraphs 0062 and 0093-0096]. Jancula is silent on using the session ticket as a 
cryptography key for encrypting or decrypting messages. Sinha teaches using the session ticket 
as a cryptography key for encrypting or decrypting messages [paragraphs 0039-0041]. It would 
have been obvious to one having ordinary skill in the art at the time of applicant's invention to 
employ the teachings of Sinha within the system of Jancula in order to enhance the security of 
the system. 

As per claim 26 Jancula teaches a computer-implemented method for enhancing the 
security of communication over a network between multiple peer application hosts, the method 
comprising: 

receiving a security certificate from a first application host [paragraphs 0056-0057]; 
generating a session ticket [paragraphs 0085 and 0088]; 
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encrypting the session ticket with a public key contained in the security certificate 
[paragraphs 0060 and 0088]; 

transmitting the session ticket to the first application host [paragraph 0088]; and 
receiving a message from the first application host [paragraphs 0091-0096]. Jancula is 
silent on the message being at least partially encrypted in accordance with the session ticket 
prior to its being encrypted with the public key. Sinha teaches an authentication system 
including message being at least partially encrypted in accordance with the session ticket prior 
to its being encrypted with the public key [paragraphs 0039-0041]. 

As per claims 2-7, Jancula further teaches the method wherein: selectively transmitting a 
security certificate to the remote system comprises selectively transmitting a security certificate 
to a service provider configured to extend the functionality of a software application by remotely 
providing a service, and receiving from the user a request comprises receiving a request for a 
delivery of said service [paragraphs 0056-0057 and 0085]. 

As per claim 8, Jancula further teaches the method wherein selectively transmitting a 
security certificate comprises selectively transmitting a security certificate that contains an 
embedded indication of the identity of an entity associated with which the user is associated 
[paragraphs 0056-0057]. 

As per claims 9 and11, Jancula further teaches the method wherein applying a collection 
of security privileges comprises applying a collection of security privileges wherein access rights 
are distributed among a plurality of user accounts each associated with a different set of 
authentication credentials [paragraphs 0057-0058 and 0071-0075]. 
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As per claims 14-15, Jancula further teaches the method wherein transmitting the 
security certificate over the network comprises transmitting the security certificate to a service 
provider configured to extend the functionality of a software application by remotely providing a 
service [paragraphs 0056-0057]. 

As per claims 16-17, Jancula further teaches the method wherein transmitting the 
security certificate over the network comprises transmitting the certificate to a remote peer 
[paragraphs 0056-0057]. 

As per claim 27, Jancula further teaches the method further comprising: generating a 
response message, encrypting the response message, and transmitting the message to the first 
application host [paragraphs 0056-0057 and 0088]. 

As per claims 28 and 29, Jancula further teaches the method further comprising 
authenticating the certificate [paragraphs 0056-0057]. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the examiner 
should be directed to BEEMNET W. DADA whose telephone number is (571 )272-3847. The 
examiner can normally be reached on Monday - Friday (9:00 am - 5:30 pm). 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Y. Vu can be reached on (571 ) 272-3859. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private 
PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you 
would like assistance from a USPTO Customer Service Representative or access to the 
automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/Beemnet W Dada/ 

Art Unit 2135 
August 30, 2008 



